Method for managing information

Abstract

The invention relates to a method for managing information associated with a subject identified by identification data, wherein in order to access data associated with the identified subject, a client: a) generates identification data of the subject or keeps same available according to specified criteria, b) generates distributed secret parts from the identification data or data derived therefrom and random values by means of a sharing algorithm, the identification data or the data derived therefrom being determinable or reconstructable from the secret parts if at least a specified minimum number of secret parts is available, and c) transmits the secret parts to a service network in the form of an account request, at least a number of services being operated which corresponds to the minimum number (MIN) of secret parts required to reconstruct the identification data or the data derived therefrom, wherein the individual services of the service network: d) do not grant one another access to the secret parts transmitted to the services and possibly stored therein, and e) manage a distributed memory for subject accounts, the subject accounts storing the secret parts together with an account identifier in said memory, the account identifier being used to assign the jointly transmitted secret parts to the respective subject account.

Description

[0001] Procedures for managing information

[0002] The invention relates to a method for anonymously creating personal identifiers.

[0003] Background of the invention

[0004] The linking of data sets while preserving privacy, also known as "Privacy-Preserving Record Linkage" (PPRL), presents a challenge at the interface between biomedical research and clinical routine: different data sets must be linked together for use in research without revealing the identities of the individuals concerned.

[0005] Research datasets typically originate from research projects, particularly clinical trials, biobanks that store samples such as blood, tissue, bone marrow, etc., or from registries, etc. These datasets are often pseudonymized to prevent the disclosure of personal information such as name, date of birth, etc., to third parties. In many cases, there are also legal regulations governing the collection of such identifying data (IDAT), for example, the General Data Protection Regulation (GDPR) within the EU.

[0006] In the field of rare diseases, routine patient care is also very closely linked to clinical trials, because study protocols largely take on the role of guidelines. As a result, most patients with rare diseases are enrolled in at least one clinical trial along their treatment pathway, their samples and genomic profiles are stored in at least one biobank, and their data are recorded in at least one registry. The importance of PPRL (Patient-Centered Relational Literature) in pediatric oncology was recently highlighted by Vassal et al. To protect patient privacy, each context (study, biobank, registry) generates a pseudonym for each patient, with different contexts generally requiring different pseudonyms to be used in accordance with the GDPR. This situation leads to two serious problems:

[0007] Firstly, if a patient is treated by more than one healthcare provider, it can very easily happen that the same patient is registered more than once in the same context, because the healthcare providers cannot recognize from the pseudonyms that the patient already exists in the context.

[0008] Secondly, datasets from different contexts cannot be linked or related to each other because different pseudonyms are used in the contexts.

[0009] PPRL solves this problem by creating opportunities for linking without compromising patient privacy.

[0010] State of the art

[0011] There are various PPRL solution providers on the market, whose solutions are based on different technological approaches. In 2013, Vatsalan et al. proposed a taxonomy for comparing PPRL solutions, which provides a good overview of 15 dimensions of PPRL. The following discussion focuses specifically on the dimensions "Privacy Technique" and "Number of Parties."

[0012] On the one hand, there are solutions like Findata in Finland, the Health Data Hub in France, or the Mainzelliste in Germany, which are based on a trusted independent institution (“Trusted Third Party,” TTP). The TTPs manage the IDAT of all patients, while the clinical data is stored in the contexts. The TTP provides the pseudonyms to these contexts. Therefore, in such solutions, the TTP can also enable the linking of data from different contexts without itself having access to the sensitive clinical data. Privacy is thus ensured by separating IDAT and clinical data. The advantage of these TTP-based solutions is that the information required for linking is stored centrally, which simplifies the linking process compared to decentralized solutions. However, the central storage of all IDAT poses a certain security risk that cannot be accepted for all applications.

[0013] On the other hand, there are solutions that apply PPRL directly between partners who know the IDAT, for example, directly between hospitals, without requiring a TTP. Laud and Pankova, for instance, applied such an approach to the EUPID Services (see below) to avoid TTP. Lazrig et al. and researchers from the Mainzelliste group published approaches based on Bloom filters. Both groups use Secure Multiparty Computation (SMPC) methods for PPRL. A disadvantage of such approaches is that, when applied to pseudonymized contexts (studies, registries, biobanks, etc.), all local data sources (hospitals) must be available for each link, and for the entire duration of the linking process. In contrast, centralized solutions require only the availability of the pseudonymized data sources (studies, registries, biobanks), not all local sources (hospitals).While privacy can be well ensured in these approaches, it is difficult to guarantee the long-term availability of all data.

[0014] Finally, there are solutions that compromise security and availability based on the approaches described above, by storing only encrypted and / or hashed IDAT data in TTPs, rather than unencrypted data. The European Patient Identity (EUPID) services were specified in the FP7 EU project European Network for Cancer Research in Children and Adolescents (ENCCA) and are currently used for PPRL in various projects, particularly in the fields of rare diseases and pediatric oncology. Although the current implementation of the EUPID services employs some additional security measures, the PPRL algorithm is fundamentally based on comparing hashed IDAT data. The Joint Research Centres (JRC) of the European Commission operate the pseudonymization service SPIDER, which was developed based on the EUPID services and hashed IDAT data.

[0015] For all solutions based on hashes, Bloom filters, etc., it is true that the TTP (Technology Transfer Protocol) or an attacker who gains access to the TTP's services can theoretically launch attacks on the derived data (especially dictionary attacks, rainbow table attacks, or brute-force attacks) in which all possible or expected combinations of IDAT are tried and the resulting data is compared with the data in memory. Even though existing services like EUPID or SPIDER have implemented measures to make these attacks more difficult, they cannot be completely prevented.

[0016] Every PPRL solution must therefore find a suitable compromise between confidentiality, integrity, and availability (also known as the CIA Triad) for the specific application. The European Union Agency for Cybersecurity (ENISA) recently published white papers with recommendations regarding pseudonymization services. However, even these recommendations cannot define a universally applicable operating point within the CIA Triad. Rather, the choice of the optimal operating point for a specific application is based on data sensitivity, the number of users, required response times, consequences in case of errors, and other factors.

[0017] Object of the invention

[0018] The present invention aims to further enhance security, particularly for solutions such as EUPID Services or SPIDER, without sacrificing the advantages of good data linkability. This is achieved by applying SMPC methods to hashed data to reduce the necessary trust assumptions regarding the TTP, for example, by distributing the TTP across multiple entities. In particular, such a solution should ensure that a malfunction of a single central service or a successful attack on a single central service does not lead to the disclosure of all data concerning the subjects. Additionally, in such an environment, the invention also aims to ensure that keys are assigned only once for the same person or subject and / or to determine whether a key has already been created for a subject.

[0019] The present invention aims to further enhance security, particularly for solutions such as EUPID Services or SPIDER, without sacrificing the advantages of good data linkability. This is achieved by applying SMPC methods to hashed data to reduce the necessary trust assumptions regarding the TTP, for example, by distributing the TTP across multiple entities. In particular, such a solution should ensure that a malfunction of a single central service or a successful attack on a single central service does not lead to the disclosure of all data concerning the subjects.

[0020] In addition, it is also the purpose of the invention in such an environment to ensure that keys are only assigned once for the same person or subject and / or to determine whether a key has already been created for a subject.

[0021] The invention solves this problem in a method of the type mentioned at the outset with the characterizing features of claim 1.

[0022] It is provided that, for the purpose of accessing data associated with the identified subject, a client: a) creates or makes available identification data of the subject according to predefined criteria, b) creates distributed secret fragments from the identification data or data derived therefrom and random values ​​using a sharing algorithm, from which the identification data or the data derived therefrom can be determined or reconstructed if at least a predefined minimum number of secret fragments are available, c) transmits the secret fragments in the form of an account request to a service network, whereby at least a number of services are operated that correspond to the minimum number of secret fragments required to reconstruct the identification data or the data derived therefrom.wherein the individual services of the service network: d) do not grant each other access to the secret parts transmitted to them and possibly stored by them, e) maintain a distributed storage for subject accounts in which they store the secret parts together with an account identifier by which the jointly transmitted secret parts can be assigned to the respective subject account, and f) upon receiving an account request for the purpose of determining whether a subject account (K) with a data record has already been created for the same subject, jointly check whether a subject account already exists that was created on the basis of the same identification data, the services cooperating in such a way that,

[0023] - all services together have sufficient information to determine, based on two data sets alone, whether the identification data used in creating the data are identical,

[0024] - without any of the services disclosing information about the content of the identification data stored by it to the other services, and

[0025] - without either service receiving additional information about the content of the identification data.

[0026] A preferred embodiment of the invention, which allows for a simple allocation of secrets to the individual services, provides that the secret parts and the services are configured such that a number of distinct identifiers are specified, with each service being assigned one identifier, and wherein, when creating the secret parts, each secret is created taking into account one of the identifiers, and the secret created with each identifier is transmitted in step c) exclusively to the service to which the same identifier is assigned.

[0027] Another preferred variant of the invention, which allows for a numerically simple and robust implementation, provides that for the identifier within the framework of a Shamir-Secret-Sharing method

[0028] - a polynomial is randomly specified, with the proviso that its value at a given base position corresponds to the identification data or a value derived therefrom, and that the degree of the polynomial corresponds at most to the minimum number (MIN) of the secret parts minus one,

[0029] - the individual identifiers of the services uniquely define the position of the support point for the polynomial in question and that the secret parts contain the value of the polynomial evaluated at the respective support point.

[0030] To easily prevent individual services from receiving information about the secrets, it can be provided that in step f) the individual services, in order to compare two secret parts received by them, in particular the transmitted secret part and a secret part already transmitted, determine the difference between the two secret parts, and that subsequently a difference polynomial is determined which returns the determined differences at the respective support points of the individual services, and this difference polynomial is evaluated at the base point, and if this evaluation yields a predetermined neutral value, in particular zero, a match of the distributed secrets is determined.To prevent targeted attempts from revealing the extent of any agreement, it can be arranged that the individual services exchange random numbers beforehand using a Beaver method and apply these numbers to the secret values ​​they have determined, so that a difference polynomial is calculated based on the differences determined by the individual services, which - compared with the difference of the two polynomials - is multiplied by a predetermined and distributed random value, whereby this polynomial is used for evaluation at the base position.

[0031] Another preferred variant of the invention, which allows adaptation to other starting situations, provides that, in the event that no matching subject account was found in step f), a new subject account is created.

[0032] To easily increase pseudonymization, it may be necessary to assign the following access information to the subject accounts in at least one of the services:

[0033] 1) Pseudonyms used for the subject in question,

[0034] 2) other services (contexts) in which data relating to the subject is stored, in particular specifying the respective pseudonym,

[0035] - that after the identification of a subject account corresponding to the identification data or after the creation of a new subject account, the access information assigned to the respective subject account is at least partially transmitted to the client.

[0036] Another preferred embodiment of the invention provides that in step c) during the preparation of the identification data for encryption, a hash method is applied to the identification data and a hash value is determined, - that the hash value preferably has the same length as the at least one for the

[0037] Encryption used keys, and

[0038] - that the hash value is used as a derived data for the formation of the shared secret.

[0039] To further increase security in a simple way, it may be provided that in step c) identification data (I) of a subject are preprocessed separately using several preprocessing methods, in particular hashing methods and / or phonetic hashing methods, so that a number of derived values ​​are obtained,

[0040] - that steps d) to e) are executed separately for the values ​​derived in this way, and in step h) for each individual transferred derived value, a separate determination is made as to whether these derived values ​​correspond to the derived values ​​already assigned to a subject account, and the determination as to whether a subject account with a data record has already been created for the same subject is made based on these individual determinations, whereby, in particular, depending on how many and / or which of the various individual determinations identify existing subject accounts, different further processing steps are carried out, such as queries to the client, determination as to whether it is the same subject, or creation of a new subject account.

[0041] Another preferred embodiment of the invention provides that, in the event that a matching subject account was found in step f),

[0042] - the individual secret parts already stored in the subject accounts are overwritten with the newly transmitted secret parts, or

[0043] - the newly transmitted parts of the secret are discarded, or

[0044] - newly transmitted secret parts are added to the individual secret parts already stored in the subject accounts and are used for further comparisons by the services of one, in particular a randomly selected, of the distributed stored secrets.

[0045] Character description

[0046] Figure 1 schematically shows a network with one client and a number of services.

[0047] The figure schematically depicts an overall architecture corresponding to a preferred first embodiment of the invention for carrying out a first embodiment of a method according to the invention for managing patient information across multiple clients (Hospital 1-n). These patients, also referred to as subjects S within the scope of the invention, are identified by identification data (IDAT) I. This identification data I, or data derived therefrom, is then used for identifying data concerning the subject, which is stored in various contexts.

[0048] The aim of this procedure is to comprehensively determine, upon receiving a request in a service network, whether a subject account with a data record has already been created for the same subject, using at least two services, EUPID1 and EUPID2. Neither of the separate services, EUPID1 and EUPID2, should have prior knowledge of the other service's data, nor should they learn it during the check. This prevents individual services from having sole access to sensitive data in the event of an attack.

[0049] In a first step a), identification data I of the subject is created according to predefined criteria. In an exemplary embodiment of the invention, a user (e.g., a physician / study assistant) starts a web browser on their local computer and opens a specific web page to register a patient in a particular context and generate a pseudonym for that context. There, they enter the first name, last name, and date of birth of the patient to be registered. On the client, this data is combined into a text, e.g., using JavaScript. This data forms the identification data I. This data is then, e.g., concatenated into a string, whereby normalization steps can be performed (e.g., taking special characters, different alphabets (Cyrillic, etc.), etc.), and the string is made available as the identification data structure.A hash Hl is derived from this identification data structure. Preferably, collision-resistant hash methods can be used, which are designed to avoid identical hashes for different identification data I. For the purposes of the invention, a hash is data derived from the identification data.

[0050] In a subsequent step b), a secret-sharing algorithm is used to create distributed secret fragments for individual services from the identification data I or data derived from it, and optionally random values. The identification data or data derived from it can be reconstructed or determined from these secret fragments or a predefined minimum number (MIN) of secret fragments.

[0051] The underlying principle of all such secret-sharing algorithms is to divide a secret, i.e., a secret sequence of data, into a multitude of different secret parts, which can then be stored separately by individual services. In this context, the secret is considered to be the identification data created for the subject S or the hash value generated from it.

[0052] By using secret-sharing algorithms, it can be ensured that no single service has sole access to the secret. Only when a minimum number of services possess their respective secret fragments can these services, together with their respective secret fragments, reconstruct the original secret. If one of the services is corrupted, the secret fragments managed by that service are unsuitable for accessing the original data or data derived from it.

[0053] As a result, all services together have sufficient information to determine, based on two data sets alone, whether the identification data I used in creating the data are identical.

[0054] Numerous different secret-sharing algorithms are known in the art. This implementation describes, by way of example, a Shamir algorithm. This algorithm is also the subject of standards ISO / IEC 4922-1 and 4922-2.

[0055] When using the Shamir algorithm, each service intended for storing secret fragments is assigned a predefined value that is unique within the entire system, meaning no other service has the same identifier. These identifiers are also publicly known within the network; that is, every service and every client knows the identifiers and the number of each service. The assignment of the identifier to the individual services typically occurs during the initial configuration of the entire system. The identifier is typically a unique number within the services, which can then be used to evaluate a polynomial.

[0056] When secret parts are created using the Shamir method, a polynomial is randomly specified, with the requirement that its value at a given base position, for example at zero, corresponds to the identification data or a value derived therefrom.

[0057] To randomly generate the polynomials, random values ​​are determined and passed to the relevant secret-sharing algorithm. In principle, any random number generator or pseudo-random number generator can be used to create these random numbers.

[0058] These random values ​​are generated separately for each transmission of a secret and then discarded. Therefore, if a secret is generated twice by the same subject, the polynomials generated based on the same secret will be different from each other, but they will always have the same value at the base position.

[0059] This base point is generally known among the services and is defined during the initial configuration of the entire system. In the implementation of the Shamir algorithm, the respective service identifier defines a base point for evaluating the previously described polynomials, ensuring that each service is assigned a unique base point that is not assigned to any other service.

[0060] When generating the secret components for each service, the polynomial containing the relevant secret at its base position is evaluated at a support point assigned to the service. This support point is derived from the identifier and, like the identifier itself, is known to all services and clients within the system. Based on the polynomial, the client can then generate the individual secret components for the services by evaluating them at the relevant support points.

[0061] This base point differs from the support points defined by the identifiers. Typically, the value 0 can be used for the base point, while different and mutually distinct values ​​can be used for the identifiers.

[0062] Within the scope of the invention, at least a number of services are operated that correspond to the minimum number MIN of secret parts required to reconstruct the identification data I or the data derived therefrom.

[0063] When using the Shamir algorithm, the choice of the degree of the polynomial determines the minimum number of correct secret values ​​required to reconstruct the secret.

[0064] The degree of the polynomial is at most equal to the number of services minus 1. If the degree of the polynomial is set to the number of services minus 1, knowledge of all parts of the secret is required to reconstruct the secret. This implementation offers a high degree of security against the possibility that knowledge of individual parts of the secret will lead to knowledge of the secret itself. Conversely, the failure of a single service renders the secrets unreconstructible.

[0065] For example, if one wants to achieve a reconstruction of the secret based on M of N secret parts for a number of N services, the degree of the polynomial can be set to Ml.

[0066] In a third step c), the individual parts of the secret are distributed to the services EUPID1 and EUPID2 as part of an account request.

[0067] The services are designed so that they do not grant each other access to the secret fragments S transmitted to them and potentially stored within them. If one of the services is compromised, an attacker cannot easily obtain the secret fragments S of the other services in order to learn the distributed secret. When storing the secret fragments, the individual services assign a mutually agreed-upon account identifier for subject accounts, which clarifies that the separately stored secret fragments belong to the same subject account and together represent a secret. The account identifier itself, however, serves only administrative purposes and does not allow any inference to be made about the secret; it can, for example, be assigned as a sequential key.Using this account identifier, the services manage a distributed storage for subject accounts K, in which they keep the secret parts S available together with an account identifier in the form of data records, via which the transmitted secret parts can be assigned to the respective subject account K.

[0068] It is subsequently assumed that several subject accounts K have already been created in the individual services and that secret fragments are already stored in each of the services for a number of account identifiers. It is further assumed that the stored secrets are different from one another.

[0069] Upon receiving an account request A, the service network should now determine whether a subject account K with a data record already exists for the same subject. To do this, all services in the service network cooperatively check whether a subject account K already exists that was created based on the same identification data I.

[0070] If no subject account K has yet been created for a subject specified in an account request A, a new subject account K can preferably be created for the subject in question. If, however, a matching subject account K is found, the client can be granted access to further information.

[0071] Step f) below describes a preferred approach for determining whether a subject account K has already been created for a subject A specified in an account request. This check is performed cooperatively between the individual services of the service network within the framework of the Shamir algorithm, by checking the individual distributed storage locations.

[0072] Subject accounts K will be compared separately with the incoming account request A.

[0073] Each of the services has, for this purpose, a secret part stored within it, which is assigned to the respective subject accounts, as well as the secret part transmitted with the incoming account request A.

[0074] All services now collectively possess sufficient information to determine, based solely on two datasets, whether the identification data I used in creating the data are identical. Within the framework of a secret-sharing algorithm, it is now possible for the individual services to reconstruct the secret without any service disclosing information about the contents of its stored identification data (I) to the other services, and without any service receiving additional information about the contents of the identification data (I).

[0075] Within the framework of the Shamir algorithm, a simple comparison operation can be performed as follows, which fulfills the aforementioned requirements:

[0076] Each service calculates the difference between the two distributed polynomials—that is, the transmitted polynomial and the polynomial stored in the respective subject account—at its respective support point. This calculation is possible because each service possesses both the secret portion relevant to the support point of the transmitted secret and the secret already stored. The difference between the two polynomials at each support point does not allow any conclusions to be drawn about the actual value of the transmitted or stored polynomial at the base point. In this way, the service network as a whole generates the values ​​of a difference polynomial at the respective support points assigned to the services.

[0077] A component of the service network, for example, one of the services or another service, now calculates the entire polynomial from the individual values ​​of the difference polynomial at the respective support points assigned to the services and evaluates this polynomial at the base point. If the value of the difference polynomial is zero, it can be assumed that the two polynomials derived from the secrets being compared do not differ at the base point, i.e., the secrets are identical. However, during the calculation, neither the services nor the component of the service network evaluating the polynomial received any information about the actual secret.

[0078] If a match is found between a distributedly stored secret and the distributedly transmitted secret, different actions can be taken depending on the requirements. In one embodiment of the invention, for example, the client can be provided with the identifier of the subject in question. The client thus receives the information that information already exists for the subject in question. Furthermore, additional information can be stored in the service network, either on one of the services or on another service, for the subject's account. This information allows access to accounts assigned to the same subject, for example, to personalized or pseudonymized results of a study in which this patient also participated. In this way, a response to the account query can be returned that allows access to further accounts assigned to the subject on other services.

[0079] No match can be found for the very first patient. Therefore, if services EUPID1 and EUPID2 do not yet contain data from subject accounts K, a new data record is created and a subject account K is generated. EUPID1 stores the secret (the value of the polynomial at its support point) S1 that is transmitted to it and generates a unique identification number EUPID 1, which it uses only internally and does not transmit to anyone else, as well as a new pseudonym PSN1 for the context chosen by the user, which is returned to the user and displayed. EUPID 2 stores the value of the polynomial transmitted to it at its support point (RI).

[0080] Each service stores the transmitted portion of the secret on its computer with an identifier assigned to the subject account, whereby the identifier for the subject account is centrally defined by the service network. Both when creating a new subject account and when it is determined that a subject account already exists, further information can be added to the subject account, which can then be retrieved during subsequent queries.

[0081] A preferred further improvement of a method based on the already described Shamir algorithm is that the individual services exchange numbers with each other beforehand, for example according to the method of Beaver (e.g. Donald Beaver, Efficient Multiparty Protocols Using Circuit Randomization, CRYPTO 1991. Springer), so that a difference polynomial is determined based on the differences determined by the individual services, which is then multiplied by a random value agreed upon in this way.

[0082] When this method is used to evaluate equality, multiplying the difference value by a random value results in no difference for identical secrets: If the difference - not multiplied by a random multiplier - is zero, then the multiplied difference is also zero and a match can be determined.

[0083] This approach, however, offers significant advantages over a client-side attack. Such attacks rely on guessed identification data and the resulting hash values, using the difference at the base station as a measure of the match between the guessed and actually stored identification data. Based on this, the identification data is modified to gain access to a subject account. This is because the calculated difference, due to multiplication by a random value (typically chosen differently for each evaluation), does not indicate a partial match. Only an exact match results in a difference of zero. This approach is described in more detail in standards such as ISO / IEC 4922-1 and 4922-2.

Claims

Patent claims 1. A method for managing information relating to a subject identified by identification data (I), wherein a client (C) for the purpose of accessing data associated with the identified subject: a) creates or makes available identification data (I) of the subject according to predefined criteria, b) creates distributed secret parts (S) from the identification data (I) or data derived therefrom and random values ​​by means of a sharing algorithm, from which the identification data (I) or the data derived therefrom can be determined or reconstructed if at least a predefined minimum number (MIN) of secret parts is available, c) transmits the secret parts (S) in the form of an account request (A) to a service network, wherein at least a number of services are operated that correspond to the minimum number (MIN) of secret parts.which is necessary for the reconstruction of the identification data (I) or the data derived therefrom, wherein the individual services of the service network: d) do not grant each other access to the secret parts (S) transmitted to them and possibly stored by them, e) maintain a distributed storage for subject accounts (K) in which they store the secret parts (S) together with an account identifier by which the jointly transmitted secret parts (S) can be assigned to the respective subject account (K), and f) upon receiving an account request (A) for the purpose of determining whether a subject account (K) with a data record has already been created for the same subject, jointly check whether a subject account (K) already exists that was created on the basis of the same identification data (I), wherein the services cooperate in such a way that, - all services together have sufficient information to determine, based on two data sets alone, whether the identification data (I) used in creating the data are identical, - without any of the services disclosing information about the contents of the identification data (I) stored by it to the other services, and - without either service receiving additional information about the contents of the identification data (I).

2. The method of claim 1, wherein the secret parts and the services are configured such that a number of distinct identifiers are specified, wherein each of the services is assigned an identifier, and wherein, when creating the secret parts, each secret is created taking into account one of the identifiers, and the secret created with each identifier is transmitted in step c) exclusively to the service to which the same identifier is assigned.

3. Method according to claim 2, characterized in that for the identifier within the framework of a Shamir-Secret-Sharing method - a polynomial is randomly specified, with the proviso that its value at a given base position corresponds to the identification data (I) or a value derived therefrom, and that the degree of the polynomial corresponds at most to the minimum number (MIN) of the secret parts minus one, - the individual identifiers of the services uniquely define the position of the support point for the polynomial in question and that the secret parts contain the value of the polynomial evaluated at the respective support point.

4. Method according to claim 2 or 3, characterized in that in step f) the individual services are used to compare two secret parts received by them, in particular the The system determines the difference between a transmitted secret part and a previously transmitted secret part, and then calculates a difference polynomial that returns the determined differences at the respective support points of the individual services, and evaluates this difference polynomial at the base point, and if this evaluation yields a predetermined neutral value, in particular zero, a match between the distributed secrets is established.

5. Method according to claim 4, characterized in that the individual services exchange random numbers among themselves beforehand according to a Beaver method and apply these numbers to the secret values ​​they have determined, so that a difference polynomial is determined based on the differences determined by the individual services, which - compared with the difference of the two polynomials - is multiplied by a predetermined and distributed random value, wherein this polynomial is used for evaluation at the base position.

6. Method according to one of the preceding claims, characterized in that, in the event that no matching subject account (K) was found in step f), a new subject account (K) is created.

7. Method according to one of the preceding claims, characterized in that - that in at least one of the services the following access information is assigned to the subject accounts: 1) Pseudonyms used for the subject in question, 2) other services (contexts) in which data relating to the subject is stored, in particular specifying the respective pseudonym, - that after the identification of a subject account (K) corresponding to the identification data (I) or after the creation of a new subject account (K), the access information assigned to the respective subject account (K) is at least partially transmitted to the client (C).

8. Method according to one of the preceding claims, characterized in that - that in step c) during the preparation of the identification data (I) for encryption, a hash procedure is applied to the identification data (I) and a hash value (H) is determined, - that the hash value (H) preferably has the same length as the at least one key used for encryption, and - that the hash value (H) is used as a derived data for the formation of the shared secret.

9. Method according to one of the preceding claims, characterized in that - that in step c) identification data (I) of a subject are preprocessed separately using several preprocessing methods, in particular hashing methods and / or phonetic hashing methods, so that a number of derived values ​​are obtained, - that steps d) to e) are carried out separately for the values ​​derived in this way, and in step h) a separate determination is made for each transferred derived value as to whether these derived values ​​correspond to the derived values ​​already assigned to a subject account (K), and the determination as to whether a subject account (K) with a data record has already been created for the same subject is carried out based on these individual determinations, whereby, in particular, depending on how many and / or which of the various individual determinations identify existing subject accounts (K), different steps are taken. further processing takes place, such as queries to the client, determination of whether it is the same subject, or creation of a new subject account (K).

10. Method according to one of the preceding claims, characterized in that, in the event that a matching subject account (K) was found in step f), - the individual secret parts already stored in the subject accounts are overwritten with the newly transmitted secret parts, or - the newly transmitted parts of the secret are discarded, or - newly transmitted secret parts are added to the individual secret parts already stored in the subject accounts and are used for further comparisons by the services of one, in particular a randomly selected, of the distributed stored secrets.

Images